1. General (as of January 1, 2025) We are thankful that you are using our website and appreciate your interest in Fans1. Protecting your privacy while using our platform is of utmost importance to us. Please read the following information carefully to understand how we handle your personal data. The following entity is responsible for the collection and processing of personal data: Website Provider: Flarex Media International LTD 64 'EXCALIBUR' Triq B. Bontadini BKR 1737, Birkirkara Malta VAT ID: MT30732825 Tax Number: 971912128 Email: support@fans1.com Payment processing and technical infrastructure: are provided in part by our integrated service partners and in part directly by Flarex Media International LTD. The processing of payment and data infrastructure is handled in accordance with applicable data protection regulations (GDPR, etc.). All data processing is carried out securely in accordance with the current legal standards and is continuously monitored to protect the rights and freedoms of our users. 2. Data collection when you visit Fans1 If you use the Fans1 website purely for informational purposes, meaning you do not register or otherwise provide us with personal data, we only collect the data that your browser automatically transmits to our server (known as “server log files”). This data is technically necessary in order to properly display the website and ensure its stability and security. The following information is collected: § The specific page on fans1.com you visited § Date and time of access § Amount of data transmitted (in bytes) § Referring source or website (how you arrived at Fans1) § Browser used § Operating system used § IP address (where applicable, stored in anonymized form) The processing of this data is based on Article 6(1)(f) GDPR, reflecting our legitimate interest in maintaining the security, technical reliability, and performance optimization of the Fans1 platform. This data will not be shared with third parties or used for any unrelated purposes. However, we reserve the right to review server log files retrospectively if there is specific and documented suspicion of unlawful behavior or misuse of the platform. 3. Cookies In order to make your visit to Fans1 as pleasant as possible and to enable the use of certain features, we use what are known as cookies on various pages of our platform. These are small text files that are stored on your device. Some of the cookies we use are session cookies, which are automatically deleted once you close your browser. Other cookies remain on your device and allow us to recognize your browser the next time you visit the platform; these are referred to as persistent cookies. When cookies are set, they may collect and process specific user information, such as browser type, location data, and IP addresses, to a limited extent. Persistent cookies are automatically deleted after a defined period, which may vary depending on the specific cookie. You can check the duration of storage for each cookie in the cookie settings section of your browser. In some cases, cookies help simplify platform functionality for example, by storing settings or saving the contents of a virtual shopping cart for a future visit. If any of the cookies used by Fans1 process personal data, such processing is carried out either: in accordance with Article 6(1)(b) GDPR, if necessary for fulfilling a contract or providing a service; in accordance with Article 6(1)(a) GDPR, if you have provided consent; or in accordance with Article 6(1)(f) GDPR, based on our legitimate interest in providing an optimal, user-friendly, and technically efficient experience on Fans1. Please note that you can configure your browser to notify you when cookies are being set and decide on a case-by-case basis whether to accept them. You may also choose to block cookies entirely or restrict them for certain scenarios. Each browser handles cookie settings differently. You can find instructions on how to change your cookie preferences in the help section of your respective browser: Internet Explorer: https://support.microsoft.com/de-de/help/17442 Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen Chrome: https://support.google.com/chrome/answer/95647 Safari: https://support.apple.com/de-de/guide/safari/sfri11471/mac Opera: https://help.opera.com/de/latest/web-preferences/#cookies Please be aware that disabling cookies may limit the functionality and user experience of the Fans1 website. 4. AI-supported image verification We use AI-supported services from the following providers for the automated verification and analysis of uploaded images: To enforce platform rules and ensure compliance with our content guidelines, all uploads are automatically scanned by: TheHive.ai - Hive AI, Inc.535 Mission Street, 14th Floor, San Francisco, CA 94105, USA - an AI-powered moderation tool. Images and videos are analyzed in real-time for potential violations. Content that fails to meet our standards are blocked automatically. Uploaded images are analyzed by our authorized service provider to ensure compliance with our Terms of Use. The processing of this data is based on Article 6(1)(f) GDPR, reflecting our legitimate interest in maintaining the security, integrity, and quality standards of the Fans1 platform. Image data is deleted immediately after the analysis, unless legal obligations or the necessity to process violations require longer retention. 5. Contacting Fans1 When you contact Fans1 (for example, via contact form or email), personal data is collected. The type of data collected depends on the information you provide and the specific fields in the contact form. This data is used exclusively for the purpose of responding to your inquiry and for any related technical administration. The legal basis for this data processing is our legitimate interest in responding to your request in accordance with Art. 6(1)(f) GDPR. If your contact is aimed at concluding a contract or establishing a business relationship, then the additional legal basis for processing is Art. 6(1)(b) GDPR. Your data will be deleted once your inquiry has been fully resolved and no legal retention obligations prevent deletion. This is the case when it is evident from the circumstances that the issue has been conclusively clarified. 6. Data Processing When Creating a User Account and for Contract Fulfillment In accordance with Art. 6(1)(b) GDPR, personal data is also collected and processed when you provide such data to us for the purpose of creating a user account on Fans1 or for fulfilling a contractual relationship (e.g., subscription or payout processing). The specific data collected is determined by the respective input forms provided during registration or onboarding. You may delete your user account at any time by contacting the data controller at the address provided at the beginning of this Privacy Policy. The data you provide will be used exclusively for contract execution and user account management. Once the contractual relationship has been fully concluded or your user account has been deleted, your data will be restricted for further processing and deleted after the expiration of statutory retention periods under tax and commercial law unless you have expressly consented to further use of your data or we are legally permitted to retain it for specific purposes. 7. Use of single Sign-On Procedures when opening a customer account On Fans1, you can create a user account or register using the "Google Sign-In" service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google") via so-called Single Sign-On technology, provided you have a Google profile. You will recognize the Google login feature on Fans1 by buttons labeled "Sign in with Google," "Continue with Google," or similar. When accessing a page on our platform that includes the Google login function, your browser establishes a direct connection to Google’s servers. The content of the login button is transmitted directly to your browser and integrated into our site by Google. Through this integration, Google is informed that your browser has accessed the relevant Fans1 page—even if you are not logged in or do not have a Google profile. This information (including your IP address) may be transmitted to and stored on servers operated by Google LLC in the USA. This processing is carried out pursuant to Art. 6 (1) (f) GDPR based on Google's legitimate interest in displaying personalized advertising related to your online behavior. By using the Google login button, you can log in or register on Fans1 using your Google account credentials. Only if you explicitly consent in accordance with Art. 6 (1) (a) GDPR during the login or registration process—after being informed about the data transfer—will Fans1 receive your general and publicly available profile data from Google, depending on your privacy settings. This data may include your user ID, name, profile picture, age, and gender. Please note that due to possible changes in Google’s privacy terms, your consent may also include the transfer of profile pictures, your friends' user IDs, and your contact list, if this data has been marked as “public” in your Google account. The data transmitted by Google will be stored and used by Fans1 to create your user account with the necessary details (e.g.,first name, last name, email address, address, country, date of birth), provided you have authorized Google to share such data. Conversely, based on your consent, certain usage data (e.g., platform interactions or purchase history) may be transferred to your Google profile. You can revoke your consent at any time by contacting the controller named at the beginning of this Privacy Policy. If consent is granted, Google may also transmit additional profile information such as your friend list, profile photos, or public identifiers, depending on your settings. Likewise, based on your consent, selected data (e.g. account usage behavior) may be shared from Fans1 back to your Google or Apple profile. You may withdraw your consent at any time by contacting the data controller listed at the beginning of this Privacy Policy. To learn more about how your data is processed by these providers, please consult their privacy policies: Google Privacy Policy: https://policies.google.com/privacy Google Terms of Use (Sign-In): https://policies.google.com/terms Apple Privacy Policy: https://www.apple.com/legal/privacy If you do not want Google or Apple to directly associate data collected on Fans1 with your respective profile, please log out of your Google or Apple account before visiting our site. You may also technically block the loading of such plugins by using browser extensions such as Adblock Plus (https://adblockplus.org). 8. Comment Functionality On Fans1, users may have the option to subscribe to follow-up comments on certain content. In order to confirm your subscription, we use a double opt-in process, meaning you will receive a confirmation email to verify that you are the owner of the email address provided. The legal basis for processing your data in connection with comment subscriptions is Art. 6(1)(a) GDPR, based on your explicit consent. You may revoke your consent and unsubscribe from ongoing comment notifications at any time with effect for the future. Details on how to unsubscribe can be found in the confirmation email you received. 9. Use of Customer Data for Direct Marketing 9.1 Subscription to Our Email Newsletter If you subscribe to the Fans1 email newsletter, we will regularly send you information about our platform, updates, and offers. The only required information for receiving the newsletter is your email address. Any additional information provided is optional and will only be used to personalize the communication. For security and verification purposes, we use the double opt-in procedure. This means that you will only receive our newsletter if you have explicitly confirmed that you wish to receive it. After you sign up, we will send you a confirmation email asking you to verify your subscription by clicking a confirmation link. By activating the confirmation link, you provide your consent to the processing of your personal data in accordance with Art. 6(1)(a) GDPR. At the time of registration, we also store the IP address assigned by your internet service provider (ISP), as well as the date and time of registration, to safeguard against potential misuse of your email address. The data collected in connection with the newsletter is used exclusively for marketing purposes via email. You may unsubscribe at any time using the link provided in each newsletter or by contacting the data controller listed at the beginning of this privacy policy. After unsubscribing, your email address will be immediately removed from our mailing list, unless you have expressly consented to further use of your data or we are legally permitted to retain it for specific purposes, as outlined in this privacy policy. 9.2 Newsletter Distribution to Existing Customers If you have provided your email address during the use of Fans1 services (e.g. purchases, subscriptions), we reserve the right to send you email offers for similar products or services from our platform. In accordance with Section 7(3) of the German Unfair Competition Act (UWG), this does not require separate consent. Processing in this case is based on our legitimate interest in personalized direct marketing in accordance with Art. 6(1)(f) GDPR. If you initially objected to the use of your email address for this purpose, no promotional emails will be sent. You may object to the use of your email address for direct marketing purposes at any time with future effect by notifying the data controller listed above. You will only incur the transmission costs according to the basic rates. Upon receiving your objection, we will immediately stop using your email address for advertising purposes. 10) Data Sharing for Contract and Payment Processing 10.1 Contract Fulfillment To process transactions and fulfill agreements made via the Fans1 platform, we work with selected service providers who support us partially or fully in executing these contracts. As part of this collaboration, certain personal data may be shared in accordance with the legal basis outlined below. If applicable, personal data collected by us will be shared with the payment institution assigned to process your payment. The transfer of data is limited to what is strictly necessary to complete the transaction. The legal basis for this transfer is Art. 6(1)(b) GDPR, which permits data processing for the performance of a contract. 10.2 Use of Payment Service Providers For the secure and reliable handling of payments on Fans1, we cooperate with the following payment service providers. These providers may receive certain personal data required to process your transaction securely and efficiently: Micropayment AG Hostattstrasse 5, 6060 Sarnen, Switzerland https://www.micropayment.de Epoch.com, LLC 30721 Russell Ranch Rd., Suite 140, Westlake Village, CA 91362, USA https://epoch.com The processing of data by these payment providers is carried out in accordance with Art. 6(1)(b) GDPR (for the performance of the payment transaction) or Art. 6(1)(f) GDPR (for our legitimate interest in a secure and efficient payment process). These providers process data under their own responsibility and in accordance with their respective privacy policies. 11. Use of a Live Chat System Fans1 uses its own integrated live chat system to provide real-time support and respond to user inquiries directly via the website. When you use the live chat feature, the chat name you provide and the content of your messages will be collected and temporarily stored for the purpose of handling your inquiry. This data is stored exclusively in the system's RAM (Random Access Memory) and is not permanently retained unless further processing is required due to legal obligations or support documentation. To operate the chat system, cookies are used. These are small text files that are temporarily stored in your browser's cache memory. Cookies enable the system to recognize returning browsers and distinguish between individual users, ensuring that your live chat session is maintained during your visit to Fans1. If the data collected through the chat function is of a personal nature, it is processed in accordance with Art. 6(1)(f) GDPR, based on our legitimate interest in providing effective customer service and conducting statistical analysis to improve user experience on the platform. You can disable cookie storage at any time by configuring your browser settings to block or delete cookies. However, please note that disabling cookies may result in the live chat functionality on Fans1 becoming unavailable or limited. 12) Tools and Other Services 12.1 Google reCAPTCHA On Fans1, we use the reCAPTCHA service provided by Google Ireland Limited, Gordon House, 4 Barrow Street, Dublin, D04 E5W5, Ireland (“Google”). This tool helps determine whether input is made by a human or by automated systems (e.g. bots), and serves to prevent abuse, spam, and fraudulent activity. As part of this service, your IP address and, where necessary, other data required by Google to provide reCAPTCHA will be transmitted to Google. This processing is based on Art. 6(1)(f) GDPR, reflecting our legitimate interest in securing our platform and ensuring its proper technical operation. Please note that this may involve data transfers to Google LLC servers in the United States. For more information on Google’s privacy practices related to reCAPTCHA, visit: https://www.google.com/intl/de/policies/privacy/ Where legally required, we obtain your explicit consent in accordance with Art. 6(1)(a) GDPR prior to using reCAPTCHA. You may revoke your consent at any time with effect for the future using the opt-out options provided. 12.2 Use of Automated Services to Protect Intellectual Property To protect our brand, the creative content of Fans1, and the intellectual property rights of our creators, we utilize automated services to detect and respond to potential copyright or trademark violations online. One such service is: legal-fans.com Provided by MM-One Legal Services LLC, a limited liability company registered in Florida, USA. This service scans publicly available content across various platforms and networks to identify possible infringements of our protected assets—such as unauthorized merchandise, improper music use, or misuse of the Fans1 brand/logo. The legal basis for this processing is Art. 6(1)(f) GDPR, based on our legitimate interest in: enforcing and protecting intellectual property rights, supporting our creators in protecting their own work, and ensuring fair conditions for all platform participants. Only publicly available personal data (such as usernames, profile images, or posts) is reviewed—and only if there is concrete suspicion of an infringement. Any data processing or sharing is conducted strictly within the limits of applicable law and only for the purpose of legal enforcement where required. More information about legal-fans.com and their data policies can be found at: https://legal-fans.com/terms-of-service/ 13) Your Rights as a Data Subject 13.1 Rights under the GDPR As a data subject, you are entitled to various rights under applicable data protection laws, particularly the General Data Protection Regulation (GDPR). Below is an overview of your rights in relation to the processing of your personal data by Fans1: § Right of Access (Art. 15 GDPR): You have the right to obtain information regarding the personal data we process about you, including the purposes of processing, the categories of data processed, recipients (or categories of recipients) to whom your data has been or will be disclosed, the intended storage duration or the criteria for determining that duration, the existence of rights to rectification, erasure, restriction of processing, or objection, the right to lodge a complaint with a supervisory authority, the source of your data (if not collected directly from you), the existence of automated decision-making (including profiling), and, where applicable, meaningful information about the logic involved and the significance and envisaged consequences of such processing, as well as the safeguards in place for international data transfers in accordance with Art. 46 GDPR. § Right to Rectification (Art. 16 GDPR): You have the right to request the immediate correction of inaccurate data or the completion of incomplete data stored by us. § Right to Erasure (Art. 17 GDPR): You may request the deletion of your personal data under the conditions laid out in Art. 17(1) GDPR. This right does not apply where processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims. § Right to Restriction of Processing (Art. 18 GDPR): You may request restriction of processing under the following circumstances: if you contest the accuracy of your data (for the time required to verify this); if the processing is unlawful but you object to deletion; if we no longer need the data for processing purposes but you require it for legal claims; or if you have objected under Art. 21 GDPR and it is not yet clear whether our legitimate grounds override yours. § Right to Notification (Art. 19 GDPR): If you have exercised your right to rectification, erasure, or restriction of processing, we are obliged to notify all recipients to whom your personal data was disclosed—unless this proves impossible or involves disproportionate effort. You also have the right to be informed about these recipients. § Right to Data Portability (Art. 20 GDPR): You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, or to request the transmission of this data to another controller, where technically feasible. § Right to Withdraw Consent (Art. 7(3) GDPR): You may withdraw your consent to data processing at any time with future effect. Upon receiving your withdrawal, we will delete your data unless there is another legal basis for processing. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal. § Right to Lodge a Complaint (Art. 77 GDPR): If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority in your country of residence, place of work, or the place of the alleged violation. 13.2 Right to Object You have the right to object at any time to the processing of your personal data, where such processing is based on a balancing of interests under Art. 6(1)(f) GDPR, due to reasons arising from your particular situation. If you lodge an objection, we will cease processing the data concerned unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or where the processing is necessary for the establishment, exercise, or defense of legal claims. If your personal data is being processed for direct marketing purposes, you have the right to object at any time to the use of your personal data for such marketing. Once you object, we will immediately stop processing your data for direct marketing purposes. 14) Duration of Storage of Personal Data The duration of storage of personal data depends on the legal basis, the purpose of processing, and—if applicable—on the statutory retention periods (e.g. commercial and tax-related retention obligations). If data is processed based on your explicit consent pursuant to Art. 6(1)(a) GDPR, it will be stored until such consent is withdrawn. If data is processed based on Art. 6(1)(b) GDPR for the purpose of fulfilling contractual or pre-contractual obligations, it will be retained for as long as necessary to fulfill the contract or initiate the business relationship. After that, it will be routinely deleted unless we are required by law to retain it longer (e.g. due to tax or commercial retention obligations) or we have a legitimate interest in continued storage. If data is processed based on Art. 6(1)(f) GDPR, it will be stored until the data subject exercises their right to object in accordance with Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject, or the processing serves the establishment, exercise, or defense of legal claims. If personal data is processed for the purposes of direct marketing in accordance with Art. 6(1)(f) GDPR, it will be stored until the data subject objects to the processing pursuant to Art. 21(2) GDPR. Unless otherwise specified in this privacy policy, personal data will be deleted once it is no longer necessary for the purpose for which it was collected or otherwise processed. Fans1 | Birkirkara, Malta Last updated: April 14, 2025 (Version 1.0)